Rule#1: Never ever click on links that contain the word ref.
If not malware attached, those are usually a part of a bigger fraud.

Rule#2: Never ever use your password outside of the application it's ment for.
If you're in the browser, make sure in the address bar is not a scam honeypot site made looking like the official site. This commonly happens with pay2win frauds where 3rd party offers you already fradulent ingame currency for free and asks you for your ingame password where in the end your acc gets stolen. Noone would refuse a freebie in a pay2win game, and scammers know it.